coffey-labs/ihasmail
1
2 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity Sponsor

Update concurrently to 10.0.6 (GHSA-pqg4-j6r4-53mv) #56

New Issue
Closed
opened 2026-10-13 21:41:20 +00:00 by jcoffey-dev · 0 comments
jcoffey-dev commented 2026-10-13 21:41:20 +00:00
Owner
Copy link
Copy source

concurrently 10.0.5 pins shell-quote 1.9.0, which has a command injection bug in quote() (GHSA-pqg4-j6r4-53mv). Dependabot flagged it on the GitHub mirror as critical.

It's only used by the npm run dev scripts, so nothing that ships is affected. concurrently 10.0.6 moves to shell-quote 1.12.0.

concurrently 10.0.5 pins shell-quote 1.9.0, which has a command injection bug in quote() (GHSA-pqg4-j6r4-53mv). Dependabot flagged it on the GitHub mirror as critical. It's only used by the npm run dev scripts, so nothing that ships is affected. concurrently 10.0.6 moves to shell-quote 1.12.0.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Something isn't working
 dependencies
Dependency updates
 documentation
Docs, README or site copy
 duplicate
Already tracked elsewhere
 enhancement
New feature or improvement
 good first issue
Good for newcomers
 help wanted
Contributions welcome
 invalid
Not a valid issue
 needs info
Waiting on the reporter for details
 question
Needs an answer, not a code change
 security
Security issue or hardening
 translation
New language or translation fixes
 wontfix
Will not be worked on
priority
p1
High priority
priority
p2
Medium priority
priority
p3
Low priority
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcoffey-dev (John Coffey)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail#56